Daily OpenSearch Error Digest to Slack

Error counts belong in the channel, not in a dashboard nobody opens. This blueprint runs one io.kestra.plugin.opensearch.Search against an application logs index with size: 0, so OpenSearch returns only the total hit count for yesterday's level: ERROR documents, and posts that number to Slack. The date window uses OpenSearch date math (now-1d/d to now/d), so the query needs no templating and the same request body works in Dev Tools.

How it works

1. count_errors (io.kestra.plugin.opensearch.Search) queries the app-logs index with a bool filter combining term on level: ERROR and a range on @timestamp rounded to yesterday's calendar day. With size: 0, no documents are fetched and the count arrives as {{ outputs.count_errors.total }}.
2. notify posts the total to Slack as a plain scalar inside the JSON payload.
3. The errors block posts a distinct Slack alert when the search fails, so a missing digest is never read as zero errors.
4. A disabled-by-default Schedule trigger runs the digest daily at 07:00.

What you get

• Yesterday's error count in Slack every morning, with zero documents transferred.
• A date window computed by OpenSearch date math, immune to timezone templating mistakes.
• A query body you can paste unchanged into OpenSearch Dashboards to drill into the hits.
• A failure alert that distinguishes a broken digest from a quiet day.

Who it's for

• Platform and SRE teams shipping application logs to OpenSearch who want a daily pulse without a dashboard.
• Engineering managers who want error trends visible where the team already reads.
• Anyone replacing a cron plus curl plus jq digest script with something observable.

Why orchestrate this with Kestra

The query is one request, but the digest is a routine: run at the same time daily, retry through a cluster blip, tell the channel the number, and raise a different signal when the query itself breaks. Kestra declares all of that in a few lines, keeps every count in the execution history so you can trace a trend backwards, and turns the total into an output any downstream task can gate on.

Prerequisites

• An OpenSearch index of application logs with level and @timestamp fields, app-logs by default.
• Credentials allowed to search that index.
• A Slack incoming webhook for the digest and failure alerts.

Secrets

• OPENSEARCH_HOST: OpenSearch endpoint, for example https://opensearch.example.com:9200.
• OPENSEARCH_USERNAME: OpenSearch username.
• OPENSEARCH_PASSWORD: OpenSearch password.
• SLACK_WEBHOOK_URL: Slack incoming webhook URL.

Quick start

1. Add the four secrets to your Kestra namespace.
2. Adjust the index name and the level field to match your log schema.
3. Execute the flow and check the Slack message carries yesterday's count.
4. Set disabled: false on the daily trigger.

How to extend

• Break the count down by service with a terms aggregation and fetchType: FETCH_ONE to read the buckets.
• Add a WARN count as a second search task and post both numbers in one message.
• Gate on the count with io.kestra.plugin.core.flow.If to escalate loud days, as shown in the OpenSearch error spike gate blueprint.
• Widen the window to seven days for a weekly digest by changing the date math and the cron.

Links

• OpenSearch plugin documentation
• OpenSearch date math documentation